Allez hop, ça s’est fait, je viens d’ajouter la config pour que fail2ban ajoute le blocage de ces bots au niveau IP automatiquement :
Author: Nicolas Peugnet <nicolas@club1.fr>
Date: Sun Jun 1 13:05:14 2025 +0200
web: block IP address of bad agents via fail2ban
Make nginx log blocked requests to a dedicated log so that it is very
easy for fail2ban to ban all of the IP addresses it contains.
This also allows to make the access logs cleaner by getting rid of all
the unwanted traffic.
@@ -0,0 +1,14 @@
+# CLUB1 Fail2Ban filter to ban all IPs logged in the blocked access log
+
+[Definition]
+
+failregex = ^<HOST>\s
+
+datepattern = {^LN-BEG}%%ExY(?P<_sep>[-/.])%%m(?P=_sep)%%d[T ]%%H:%%M:%%S(?:[.,]%%f)?(?:\s*%%z)?
+ ^[^\[]*\[({DATE})
+ {^LN-BEG}
+
+# DEV Notes:
+# Based on nginx-bad-request filter
+#
+# Author: Nicolas Peugnet
@@ -19 +19,7 @@ mode = aggressive
enabled = true
+
+[nginx-blocked]
+enabled = true
+port = http,https
+logpath = /var/log/nginx/blocked.log
+maxretry = 2
@@ -1,6 +1,17 @@
-# Close connection based on the useragent map defined in /etc/nginx/conf.d/badagents.conf.
+# Close connection based on the useragent map defined in /etc/nginx/conf.d/badagents.conf
+# and set the access log of blocked request to a dedicated file for easier processing by
+# fail2ban.
+#
+# We first use the reserved 418 error code to be able to redirect to a named location
+# as access_log cannot be set in "if in server" blocks.
# The non-standard code 444 closes a connection without sending a response header.
if ($badagent) {
- return 444;
+ return 418;
}
+error_page 418 = @blocked;
+
+location @blocked {
+ access_log /var/log/nginx/blocked.log;
+ return 444;
+}
Ça fonctionne nickel :
$ sudo fail2ban-client status nginx-blocked
Status for the jail: nginx-blocked
|- Filter
| |- Currently failed: 348
| |- Total failed: 742
| `- File list: /var/log/nginx/blocked_access.log
`- Actions
|- Currently banned: 18
|- Total banned: 18
`- Banned IP list: 54.147.238.89 52.71.216.196 34.231.45.47 52.200.142.199 98.83.177.42 52.45.15.233 3.215.221.125 52.1.157.90 3.142.50.218 3.229.164.203 3.81.253.213 18.232.11.247 3.232.39.98 18.205.91.101 35.173.18.61 54.164.106.236 54.91.122.193 34.202.88.37
$ sudo nft list chain inet f2b-table f2b-chain
table inet f2b-table {
chain f2b-chain {
type filter hook input priority filter - 1; policy accept;
tcp dport 22 ip saddr @addr-set-sshd counter packets 48 bytes 2880 drop
tcp dport { 25, 465, 587 } ip saddr @addr-set-postfix counter packets 3 bytes 156 drop
tcp dport { 110, 143, 465, 587, 993, 995, 4190 } ip saddr @addr-set-dovecot counter packets 0 bytes 0 drop
tcp dport { 80, 443 } ip saddr @addr-set-nginx-blocked counter packets 51 bytes 3846 drop
}
}